[loOll]

Filburt, excuse my continued confusion, but how is:

PHP Code:

eval("\$customfields .= \"".gettemplate("getinfo_customfields")."\";"); 


different than:

PHP Code:

$customfields .= gettemplate("getinfo_customfields"); 


Xenon, I should have explained a bit more. Same example:

PHP Code:

eval("\$customfields .= \"".gettemplate("getinfo_customfields")."\";"); 


If gettemplate returns -- "; system("blah"); // -- you have a statement which evaluates to something like:

PHP Code:

eval('$customfields .= ""; system("blah"); // ";'); 


When that's eval'ed, the command `blah` is run. This is of course a potential vulnerability, and depends upon another vulnerability in vB which either lets one taint $templatecache or modify a template row (which may be a vulnerability in another webapp that uses the same database). Being able to run system commands is more dangerous than a typical sql injection vulnerability.

I see the risk here, but not the benefit.